Loading npm security reports…

@stacksjs/push@0.70.61: Clean npm security report (Allow) | LPM Firewall

registry / @stacksjs/push / 0.70.61

@stacksjs/push@0.70.61

The Stacks Push integration

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package sends caller-supplied push payloads to Expo or Firebase only through explicit exported runtime functions.

Static reason

One or more suspicious static signals were detected.

Trigger

Application calls `send`, Expo helpers, or FCM helpers after configuring credentials.

Impact

Delivers user-requested notifications; no package-originated credential harvesting or unconsented mutation was found.

Mechanism

Explicit push-notification delivery via Expo and Firebase APIs.

Rationale

The static signals reflect the package's stated push-notification purpose. Source inspection shows no install-time execution or concrete malicious behavior.

Evidence

package.jsondist/index.jsdist/index.d.tsREADME.md

Network endpoints7

exp.host/--/api/v2/push/sendexp.host/--/api/v2/push/getReceiptsfcm.googleapis.com/fcm/sendfcm.googleapis.com/v1/projectsoauth2.googleapis.com/tokeniid.googleapis.com/iid/v1:batchAddiid.googleapis.com/iid/v1:batchRemove

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has only `prepublishOnly`; no install lifecycle hook.
`dist/index.js` exports push functions; network calls occur only when those APIs are invoked.
FCM credentials are caller-provided configuration and used only for Firebase authentication.
No filesystem access, subprocesses, dynamic code execution, persistence, or AI-agent configuration mutation found.

Behavioral surface

Source

Network

Supply chain

MinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 7.50 KB of source, external domains: exp.host, fcm.googleapis.com, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-3javascript

1// @bun

2var y=Object.defineProperty;var h=(G)=>G;function T(G,J){this[G]=h.bind(null,J)}var C=(G,J)=>{for(var N in J)y(G,N,{get:J[N],enumerable:!0,configurable:!0,set:T.bind(J,N)})};var z={};C(z,{sendBatch:()=>L,send:()=>j,isExpoPushToken:()=>w,getReceipts:()=>E,default:()=>u,Send:()=>j});import{log as X}from"@stacksjs/cli";var d="https://exp.host/--/api/v2/push/send";function w(G){return/^Expo(?:nent)?PushToken\[.+\]$/.test(G)||/^[a-zA-Z0-9-_]+$/.test(G)}async function j(G){let J=Array.isArray(G.to)?G.to:[G.to],N=J.filter((W)=>!w(W));if(N.length>0)X.warn(`Invalid Expo push tokens found: ${N.join(", " ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/index.jsView file

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

2patternName = private_key_rsa severity = critical line = 2 matchedText = var y=Ob...CM};

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L2

Findings

2 Critical1 Medium3 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings